Your sending domain: SPF, DKIM and DMARC

The desk's emails (confirmations, replies, notifications) are sent from your address, like [email protected]. Mail systems such as Gmail and Microsoft 365 decide whether to trust them by three DNS records on the domain. Without them, the desk's emails land in spam or are refused, and a requester never sees the answer.

Record	What it says	Where
SPF	Which servers may send email for the domain.	A TXT record on the domain (for Resend, on send.<domain>), starting v=spf1.
DKIM	The email service's signature: the email wasn't changed and really comes from the domain.	A TXT record at <selector>._domainkey.<domain>, with the public key the email service gives you.
DMARC	What a receiving mail system does with email that fails both: nothing, spam or refuse.	A TXT record at _dmarc.<domain>, starting v=DMARC1.

Adding them

Your email service (Resend, or your SMTP provider) shows the exact SPF and DKIM records when you add the domain to it. Add them at the company that runs the domain's DNS, then verify the domain in the email service.

For DMARC, start with this record at _dmarc.<domain>, which only reports and changes nothing:

v=DMARC1; p=none; rua=mailto:[email protected]

Once SPF and DKIM pass for everything that sends as the domain (the desk, your own mail system, newsletters), raise it to p=quarantine and later p=reject.

[!TIP] Your SPF record must end with ~all or -all. +all lets anyone send as the domain.

Checking them

Under Platform → Email → Sending (Platform Administrators only), Check the sender domain looks up the three records for the domain of the Default sender, as it is in the form, saved or not. It says which are missing, like "example.com: DKIM, DMARC missing", and shows each record it found. An SPF record that ends in +all counts as missing; a DMARC record with p=none passes, marked as monitoring only. It reads public DNS only, so it works before anything is sent. A record you just added can take a few minutes, sometimes hours, to be seen.

The DKIM check looks for a key at Resend's selector and the usual ones (google, selector1, selector2, default …). If your email service uses another selector, its own dashboard is where to confirm it.

Brands with their own sender

A brand that sends from its own domain, like [email protected], needs the same three records on that domain, and the domain verified with the email service. An AI assistant connected to the desk can check every domain the desk sends from at once with the check_setup tool (MCP).